Parallel Flow-Sensitive Pointer Analysis by Graph-Rewriting

Transcription

1 Parae Fow-Sensitive Pointer Anaysis by Grah-Rewriting Vaivaswatha Nagaraj R. Govindarajan Indian Institute of Science, Bangaore PACT 2013

2 2 Outine Introduction Background Fow-sensitive grah-rewriting formuation Imementation and Resuts Concusion

3 3 Outine Introduction Background Fow-sensitive grah-rewriting formuation Imementation and Resuts Concusion

4 4 Fow-sensitive ointer anaysis 1 x = &a y = &b 2 3 z = x z = y z oints-to {?} z oints-to {?} 4

5 5 Fow-sensitive ointer anaysis 1 x = &a y = &b 2 3 z = x x oints-to a y oints-to b z oints-to a x oints-to a y oints-to b z = y 4 x oints-to a y oints-to b z oints-to b

6 Fow-sensitive vs fow-insensitive 1 x = &a y = &b 2 3 z = x x oints-to a y oints-to b z oints-to {a,b} x oints-to a y oints-to b z = y 4 x oints-to a y oints-to b z oints-to {a,b} 6

7 7 Outine Introduction Background Staged fow-sensitive anaysis Grah-rewriting Fow-sensitive grah-rewriting formuation Imementation and Resuts Concusion

8 Staged fow-sensitive ointer anaysis 8 [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] Scaes to arge rograms Faster, ess recise anaysis used to seed u the rimary anaysis

9 Staged fow-sensitive ointer anaysis 9 [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] Scaes to arge rograms Faster, ess recise anaysis used to seed u the rimary anaysis Our goa: Paraeize the staged fow-sensitive ointer anaysis

10 10 Staged fow-sensitive anaysis [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] oints-to {a,b} a oints-to {,q} b oints-to {r,s} 1 2 * = u1 v1 = * w1 = *z1 3 In a traditiona anaysis, oints-to info of both a & b wi be roagated to both 2 and 3

11 11 Staged fow-sensitive anaysis [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] oints-to {a,b} a oints-to {,q} b oints-to {r,s} 1 oints-to {b} 2 * = u1 v1 = * w1 = *z1 z1 oints-to {a} 3

12 12 Staged fow-sensitive anaysis [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] oints-to {a,b} a oints-to {,q} b oints-to {r,s} 1 oints-to {b} 2 z1 oints-to {a} v1 = * w1 = *z1 Points-to info of ony b is required here * = u1 3 Points-to info of ony a is required here

13 13 Staged fow-sensitive anaysis [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] How does staged anaysis work? (1) Use a fast anaysis to get ess recise oints-to information 1 {a,b} z1 {a} {b} w1 {c} 2 * = u1 v1 = * w1 = *z1 3 *w1 = t2 4

14 14 Staged fow-sensitive anaysis [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] How does staged anaysis work? (1) Use a fast anaysis to get ess recise oints-to information (2) Use the ess recise info to find variabes otentiay referenced at indirections 1 * = u1 a1 = (a0) b1 = (b0) {a,b} z1 {a} {b} w1 {c} 2 µ(a1) v1 = * w1 = *z1 µ(b1) *w1 = t2 3 4 c2 = (c1)

15 15 Staged fow-sensitive anaysis [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] How does staged anaysis work? 1 Fow-sensitivity A variabes in SSA form 2 * = u1 a1 = (a0) b1 = (b0) µ(a1) v1 = * w1 = *z1 µ(b1) *w1 = t2 3 4 c2 = (c1)

16 16 Staged fow-sensitive anaysis [Fow-sensitive ointer anaysis for miions of ines of code Ben Hardekof. et a. - CGO'11] How does staged anaysis work? 1 Fow-sensitivity A variabes in SSA form 2 * = u1 a1 = (a0) b1 = (b0) µ(a1) v1 = * w1 = *z1 µ(b1) Proagation of information is thus otimized (3) Buid def-use chains and roagate ony aong these chains *w1 = t2 3 4 c2 = (c1)

17 Paraeizing the staged anaysis Can the staged fow sensitive ointer anaysis be araeized and scaed to mutie cores? 17

18 Towards a arae agorithm # Fow-insensitive ointer anaysis has aready been araeized# Paraeization of fow-insensitive anaysis invoves transforming it to a grah-rewriting robem exose amorhous data-araeism [Parae Incusion-based Points-to Anaysis - Mario Mendez-Lojo, et a. - OOPSLA'10] 18

19 Towards a arae agorithm Fow-insensitive ointer anaysis has aready been araeized# Paraeization of fow-insensitive anaysis invoves transforming it to a grah-rewriting robem exose amorhous data-araeism Our goa: Paraeize the staged fow-sensitive ointer anaysis Formuate it as a grah-rewriting robem # [Parae Incusion-based Points-to Anaysis - Mario Mendez-Lojo, et a. - OOPSLA'10] 19

20 20 Outine Introduction Background Staged fow-sensitive anaysis Grah-rewriting Fow-sensitive grah-rewriting formuation Imementation and Resuts Concusion

21 21 Grah-rewriting [Parae Incusion-based Points-to Anaysis - Mario Mendez-Lojo, et a. - OOPSLA'10] Points to constraint Constraint grah x = &a x y=x x c a y

22 22 Grah-rewriting [Parae Incusion-based Points-to Anaysis - Mario Mendez-Lojo, et a. - OOPSLA'10] Points to constraint Constraint grah x a x = &a x c x y=x a c Ay rewrite-rue y x a c y y Exame: coy rewrite rue

23 23 Outine Introduction Background Fow-sensitive grah-rewriting formuation Imementation and Resuts Concusion

24 24 Grah-rewriting formuation 1 * = u1 a1 = (a0) b1 = (b0) 2 µ(a1) v1 = * w1 = *z1 µ(b1) *w1 = t2 3 4 c2 = (c1) Grah: Nodes: Variabes in the rogram Edges: Points-to, coy, oad, store, etc... Rewrite rues?

25 25 Chaenges Directy using the fow-insensitive grah formuation for fow-sensitive anaysis eads to the foowing chaenges Surious edges eads to imrecision Strong and weak udates at store constraints are not handed

26 26 Chaenges Directy using the fow-insensitive grah formuation for fow-sensitive anaysis eads to the foowing chaenges Surious edges eads to imrecision Soution: otentia edges Strong and weak udates at store constraints are not handed Soution: kique nodes

27 27 Outine Introduction Background Fow-sensitive grah-rewriting formuation Probem of surious edges Handing strong and weak udates Imementation and Resuts Concusion

28 28 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints = &a = *

29 29 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints = &a = * Formuate grah a

30 30 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints = &a = * Formuate grah a a c Ay oad rue

31 31 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints = &a = * Formuate grah Ay oad rue a a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) z1 = * µ(a2)

32 32 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints Formuate grah = &a Ay oad rue a = * a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) z1 = * µ(a2) a1

33 33 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints Formuate grah = &a Ay oad rue a = * a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) z1 = * µ(a2) a1 z1 a2

34 34 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints Formuate grah = &a Ay oad rue a = * a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) z1 = * µ(a2) a1 z1 a2

35 35 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints Formuate grah = &a Ay oad rue a = * a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) z1 z1 c z1 = * µ(a2) a1 a2 c a1 a2

36 36 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints Formuate grah = &a Ay oad rue a = * a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) z1 z1 c z1 = * µ(a2) a1 a2 c a1 Surious edge a2

37 37 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints Formuate grah = &a Ay oad rue a = * a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) z1 z1 c z1 = * µ(a2) a1 a2 c a1 Surious edge a2

38 38 Surious edges - Load rue for fow-insensitive anaysis: Points-to constraints Formuate grah = &a Ay oad rue a = * a c - Loss of recision when used for fow-sensitive anaysis: = * µ(a1) c z1 z1 c z1 = * µ(a2) a1 a2 c a1 Surious edge a2

39 Soution: Potentia edges A otentia edge of tye t means that, there coud be an actua edge of tye t, between the same two nodes Potentia edges are added during initia grah construction Some rewrite rues are modified to ook for otentia edges 39

40 40 Soution: Potentia edges - Modified oad rue: Formuate grah = &a = * Modified oad rue a _c a c

41 41 Soution: Potentia edges - Modified oad rue: Formuate grah = &a Modified oad rue a = * a _c c - Modified rue aied to fow-sensitive anaysis: = * µ(a1) z1 _c _c z1 = * µ(a2) a1 a2

42 42 Soution: Potentia edges - Modified oad rue: Formuate grah = &a Modified oad rue = * a a _c c - Modified rue aied to fow-sensitive anaysis: = * µ(a1) _c a1 a2 z1 _c z1 = * µ(a2) z1 c c a1 a2

43 43 Outine Introduction Background Fow-sensitive grah-rewriting formuation Probem of surious edges Handing strong and weak udates Imementation and Resuts Concusion

44 Strong and weak udates As the fow sensitive anaysis rogresses: * = u1 a1 = (a0) b1 = (b0) 44

45 Strong and weak udates As the fow sensitive anaysis rogresses: How to udate a1? * = u1 a1 = (a0) b1 = (b0) 45

46 Strong and weak udates As the fow sensitive anaysis rogresses: How to udate a1? * = u1 a1 = (a0) b1 = (b0) oints-to {a1} 46

47 Strong and weak udates As the fow sensitive anaysis rogresses: How to udate a1? * = u1 a1 = (a0) b1 = (b0) Strong Udate oints-to {a1} a 1 u1 47

48 48 Strong and weak udates As the fow sensitive anaysis rogresses: How to udate a1? * = u1 a1 = (a0) b1 = (b0) Strong Udate oints-to {a1} oints-to {a1,b1} a 1 u1

49 49 Strong and weak udates As the fow sensitive anaysis rogresses: How to udate a1? Strong Udate oints-to {a1} a 1 u1 * = u1 a1 = (a0) b1 = (b0) Weak Udate oints-to {a1,b1} a1 u1 a0

50 50 Strong and weak udates * = u1 a1 = (a0) b1 = (b0) udate a1 as if oints to a then a1 u1 end if if oints to b then a1 a0 end if

51 51 Strong and weak udates Points-to set of a deends 1 on whether oints-to * = u1 a1 = (a0) b1 = (b0) b1 udate a1 as if oints to a then a1 u1 end if if oints to b then a1 a0 end if

52 52 Strong and weak udates Points-to set of a deends 1 on whether oints-to * = u1 b1 udate a1 as a1 = (a0) b1 = (b0) if oints to b then a1 a0 end if Connect a and 1 if oints to a then a1 u1 end if b1

53 Strong and weak udates * = u1 a1 = (a0) b1 = (b0) Soution: Connect a variabes on the LHS of, within a store. Use a kique node as the common connection. a1 k b1 1-1 kique node store constraint 53

54 54 Strong and weak udates * = u1 a1 = (a0) b1 = (b0) udate a1 as if oints to a then a1 u1 end if if oints to b then a1 a0 end if

55 55 Strong and weak udates * = u1 if oints to a then a1 u1 end if udate a1 as a1 = (a0) b1 = (b0) if oints to b then a1 a0 end if Rewrite rue to udate a : 1 a1 s a1 s _c u1 c u1

56 56 Strong and weak udates * = u1 a1 = (a0) b1 = (b0) udate a1 as if oints to a then a1 u1 end if if oints to b then a1 a0 end if

57 57 Strong and weak udates * = u1 udate a1 as a1 = (a0) b1 = (b0) if oints to a then a1 u1 end if if oints to b then a1 a0 end if Rewrite rue to udate a : (2 stes) 1 k1 b1 b1 Note: The rewrite rue shown here is not comete.

58 58 Strong and weak udates * = u1 if oints to a then a1 u1 end if udate a1 as a1 = (a0) b1 = (b0) if oints to b then a1 a0 end if Rewrite rue to udate a : (2 stes) 1 b1 k1 b1 k1 k1 b1 a0 c a1 Note: The rewrite rue shown here is not comete.

59 59 Strong and weak udates * = u1 a1 = (a0) b1 = (b0) udate a1 as if oints to a then a1 u1 end if if oints to b then a1 a0 end if Handed

60 Aying the rewrite rues Rewrite rues can be aied in any order, and to any node Rewrite rues are aied unti fixed oint At any time, there may be mutie nodes ready for rewrite rue aication, aowing arae aication of rewrite rues 60

61 61 Outine Introduction Background Fow-sensitive grah-rewriting formuation Imementation and Resuts Concusion

62 Imementation detais Inte threading buiding bocks (TBB) used to manage arae workoad A dua-workist based aroach to kee track of nodes for rocessing A hash tabe based concurrent data structure (concurrent_unordered_set), rovided by TBB used to reresent grah edges 62

63 Machine configuration 4-socket machine 2.0 GHz, 8-core rocessor on each socket 64GB memory Debian GNU/Linux 6.0 Inte Threading Buiding Bocks

64 64 Benchmarks Benchmark Number of grah nodes Larger (ines of code) rograms from SPEC k - 414k Ex text rocessor 19k Nethack text based game 222k Sendmai emai server 71k SVN revision contro system 6439k Vim text editor 1265k A of these have been used in revious ointer anaysis exeriments

65 65 Scaing

66 66 Outine Introduction Background Fow-sensitive grah-rewriting formuation Imementation and Resuts Concusion

67 67 Concusion First araeization of recise fow-sensitive ointer anaysis Fow-sensitive ointer anaysis as a grahrewriting robem easy to take advantage of amorhous data araeism Scaing of u to 6.9x, for 8 threads shown

68 68 Acknowedgement PACT student trave grant GARP student grant - IISc Ben Hardekof and Mario Mendez-Lojo Ruesh Nasre HPC ab members SERC IISc

69 69 Thank you Questions?

70 x 08 x Backu: recent resuts combine workists thread 2 threads 4 threads 6 threads 8 threads seedu ex 254.ga 176.gcc nethack 253.er 197.arser sendmai vim svn 255.vortex

71 Backu: Comarison with SFS 71

72 72 Backu: Program size

73 Backu: Average workist size (a).. (h) are workists for each rewrite rue 73

74 Backu: - Future work Exore different orders of aying rewrite rues Reordering nodes for ocaity might give better scaing Extend for context-sensitivity Using concurrent sarse-bit-vectors for reresenting edges may imrove erformance 74